URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection targets adversaries leveraging ELF-based malware distribution through compromised or newly registered web endpoints identified by URLhaus. Proactively hunting for these specific malicious URLs in Azure Sentinel is critical to intercept early-stage command-and-control communications and prevent lateral movement before the malware executes on endpoint systems.

IOC Summary

Threat: elf Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["94.154.43.42", "45.207.196.86"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.42", "45.207.196.86"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Update Scans via WSUS/SCCM

  • Scenario: The Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager (MECM/SCCM) servers periodically scan the update.microsoft.com and download.windowsupdate.com domains to check for patches. These high-volume, legitimate update endpoints are frequently flagged by URLhaus as “elf” (Executable/Legitimate File) due to their dynamic content delivery networks hosting executable payloads that mimic malware signatures during initial scanning phases.
  • Filter/Exclusion: Create a whitelist exclusion for the specific hostnames *.update.microsoft.com and *.download.windowsupdate.com when the source IP belongs to the internal WSUS/SCCM server subnet (e.g., 10.x.x.x).

• Endpoint Protection Real-Time Scanning by CrowdStrike or SentinelOne

  • Scenario: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or SentinelOne perform real-time “on-access” scanning. When a user downloads a large installer (e.g., an Adobe Creative Cloud update), the EDR agent may proactively query URLhaus to verify the integrity of the download source before allowing execution. This internal verification traffic often triggers the rule because the EDR’s own telemetry service is querying the malicious URL database, generating hits on legitimate URLs that share characteristics with known “elf” threats.
  • Filter/Exclusion: Exclude traffic originating from the specific EDR management console IP ranges (e.g., CrowdStrike Cloud IPs or SentinelOne SaaS IPs) where the destination port is 443 and the User-Agent string contains Falcon or SentinelOne.

• **Scheduled Antivirus Definition Updates